TI-2021-17966 Aliases CVE-2021-41127 GHSA-4365-fhm5-qcrx

Maliciously Crafted Model Archive Can Lead To Arbitrary File Write in rasa

LOW 33CWE-22Published 2021-10-21 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functionality that loads a trained model `tar.gz` file which allows a malicious actor to craft a `model.tar.gz` file which can overwrite or replace bot files in the bot directory. The vulnerability is fixed in Rasa 2.8.10. For users unable to update ensure that users do not upload untrusted model files, and restrict CLI or API endpoint access where a malicious actor could target a deployed Rasa instance.

Why it matters now

EPSS 0.00758 55th percentileScored 2026-11-07

Fix Fixed rasa (RasaHQ): 2.8.10rasa (PyPI): 2.8.10

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
RasaHQ	rasa	before 2.8.10	2.8.10	Patch available	CNA
—	rasa (PyPI)	before 2.8.10	2.8.10	Patch available	GHSA-4365-fhm5-qcrx

rasa VendorRasaHQ Affected before 2.8.10 Fixed in 2.8.10 Patch available CNA
rasa (PyPI) Vendor— Affected before 2.8.10 Fixed in 2.8.10 Patch available GHSA-4365-fhm5-qcrx

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:rasa:rasa::::::::	before 2.8.10	Vulnerable	Rasa

cpe:2.3:a:rasa:rasa:*:*:*:*:*:*:*:* Versions before 2.8.10 Vulnerable ·Rasa

Remediation

Fix · CNA rasa (RasaHQ) Fixed in 2.8.10
Fix · GHSA-4365-fhm5-qcrx rasa (PyPI) Fixed in 2.8.10 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-41127
2026-10-03 Alias added: GHSA-4365-fhm5-qcrx

References

Patch 1

https://github.com/RasaHQ/rasa/commit/1b6b502f52d73b4f8cd1959ce724b8ad0eb33989

Advisory 1

https://github.com/RasaHQ/rasa/security/advisories/GHSA-4365-fhm5-qcrx

Other 2

TI-2024-32960 Remote Code Execution via Remote Model Loading in Rasa CVSS 3.1CRITICAL 9.1
TI-2025-23456 Rasa Pro Missing Authentication For Voice Connector APIs CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences